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MEMORANDUM OF THE UNITED STATES 
IN RESPONSE TO THE COURT'S ORDER DATED JANAURY 28, 2009 (U) 

The United States of America, by and through the undersigned Department of 
Justice attorneys, respectfully submits this memorandum and supporting Declaration of 
Lt. General Keith B. Alexander, U.S. Army, Director, National Security Agency (NSA), 
attached hereto at Tab 1 ("Alexander Declaration"), in response to the Court's Order 
Regarding Preliminary Notice of Compliance Incident Dated January 15, 2009 ("January 
28 Order").^TS)^^ 

The Government acknowledges that NSAs descriptions to the Corn! of tire alert 
list process described in the Alexander Decimation were inaccurate and that the 
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Business Records Order did not provide the Government wiih authority to employ the 
alert list in the manner in which it did. (TS//SI//N F) — 

For the reasons set forth below, however, tire Court should not rescind or modify 
its Order in docket number BR 08-13. The Government has already taken significant 
steps to remedy the alert list compliance incident and has commenced a broader review 
of its handling of the metadata collected in this matter. In addition, die Government is 
taking additional steps to implement a more robust oversight regime. Finally, the 
Government respectfully submits that the Court need not take any further remedial 
action, including through the use of its contempt powers or by a referral to the 
appropriate investigative offices. 1 - (TS//SI//MF ) 

BACKGROUND (U) 

X. Events Preceding the Court's January 28 Order (S)\ 

In docket number BR 06-05, the Government sought, and the Court authorized 

NSA, pursuant to the Foreign Intelligence Surveillance Act's (FISA) tangible things 

provision, 50 U.S.C. § 1861 et seq„ to collect in bulk and on an ongoing basis certain call 



1 The January 28 Order directed the Government to file a brief to help the Court assess 
how to respond to this matter and to address seven specific issues. This memorandum 
discusses the need for further Court action based, in part, on the facts in the Alexander 
Declaration, which contains detailed responses to each-of the Court's specific questions. See 
Alexander Decl. at 24-39."jS)^ 
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detail records or "telephony metadata/' so that NSA could analyze the metadata using 



contact chainin 




tools . 2 (TS//SI//M F} 



FISA's tangible things provision authorizes the Director of the Federal Bureau of 



Investigation (FBI) or his designee to apply to this Court 

for an order requiring the production of any tangible things (including 
books, records, papers, documents, and other items) for an investigation 
to obtain foreign intelligence information not concerning a United States 
person or to protect against international terrorism or clandestine 
intelligence activities, provided that such investigation of a United States 
person is not conducted solely on the basis of activities protected by the 
first amendment to the Constitution. 

50 U.S.C. § 1861(a)(1). FISA's tangible things provision directs the Court to enter an ex 



parte order requiring the production of tangible things and directing that the tangible 
things produced in response to such an order be treated in accordance with 
minimization procedures adopted by the Attorney General pursuant to section 1861(g), 



if the judge finds that the Government's application meets the requirements of 50 U.S.C. 
§ 1861(a) & (b). See 50 U.S.C. § 1861(c)(1). (U) 

In docket number BR 06-05 and each subsequent authorization, including docket 
number BR 08-13, this Court found that the Government's application met the 



requirements of 50 U.S.C. § 1861(a) & (b) and entered an order directing that the BR 
metadata to be produced— call detail records or telephony metadata— be treated in 



2 The Government will refer herein to call d-g-tailrecords collected pursuant to the 
Court's authorizations in this matter as "BR metadata," (IS) — 
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accordance with the rniriiixhzation procedures adopted by the Attorney General. 



Among these minimization procedures was the following; 



Any search or analysis of the data archive shall occur only after a 
particular known telejahon^nmdaer has been associated with | 

* """"^.[3] More specifically, access to the 

archived data shall occur only when NSA has identified a known 
telephone number for which, based on the factual and practical 
considerations of everyday life on which reasonable and prudent persons 
act, there are facts giving rise to a reasonable, articulable suspicion that the 
telephone number is associated with 

organization; provided, however, that a telephone number believed to be 
used by a U.S. person shall not be regarded as associated with 

solely on the basis of activities that are 

protected by the First Amendment to the Constitution. 



Order, docket number BR 06-05, at 5 (emphasis added); see also Memo, of Law in Supp. 
of Application for Certain Tangible Things for Investigations to Protect Against 
International Terrorism, docket number BR 06-05, Ex. C, at 20 (describing the above 
requirement as one of several minimization procedures to be applied to the collected 
metadata). 4 - (T5//SI//NF) 



3 Authorizations after this matter was initiated in May 2006 expanded the telephone 
identifiers that NSA could query to those identifiers associated 

j flUfljsee generally docket number BR 06-05 (motion to amend granted in August 2006), and 

later see generally docket number 

BR 07-10 (motion to amend granted in June 2007). The Court! s authorization in docket number 
BR 08-13 approved querying related tc 

Primary Order, docket number 

BR 08-13, at 8. (TS//SI//NF) 



4 In addition, the Court's Order in docket number BR 06-05 and each subsequent 
authorization, including docket number BR 08-13, required that "[although the data collected 
under this Order will necessarily be broad, the use of that information for analysis shall be 
strictly tailored to identifying terrorist communications and shall occur solely according to the 
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On December 11 , 2008, the Court granted the most recent reauthorization of the 
BR metadata collection. For purposes of querying the BR metadata, as in prior Orders 
in this matter, the Court required the Government to comply with the same standard of 
reasonable, articulable suspicion set forth above. Primary Order, docket number BR OS- 
13, at 8-9. 5 _-{55//Sl//NF )— 

On January 9, 2009, representatives from the Department of Justice's National 
Security Division (NSD) attended a briefing at NSA concerning the telephony metadata 
collection. 6 At the briefing, NSD and NSA representatives discussed several matters, 
including the alert list. See Alexander Deck at 17, 27-28. Following the briefing and on 
the same day, NSD sent NSA an e-mail message asking NSA to confirm NSD's 
understanding of how the alert list operated as described at the briefing. Following 
additional investigation and the collection of additional information, NSA replied on ■ 



procedures described in tire application, including the minimization procedures designed to 
protect U.S. person information." See, e.g.. Order, docket number BR 06-05, at 6 1 D. 

-(TS//ST//MF) . 

5 In this memorandum the Government will refer to this standard as the "RAS standard" 
and telephone identifiers that satisfy the standard as "RAS-approved." 

6 Tire names of the Department of Justice representatives who attended the briefing are 
included in the Alexander Declaration at page 28. The date of this meeting, January 9, 2009, 
was the date on which these individuals first learned (later confirmed) that the alert list 
compared non-RAS-approved identifiers to the incoming BR metadata. Other than these 
individuals (and other NSD personnel with whom these individuals discussed this matter 
between January 9 and January 15, 2009), and those NSA personnel otherwise identified in the 
Alexander Declaration, NSD has no record of any other executive branch personnel who knew 
that the alert list included non-RAS-approved identifiers prior to January 15, 2009. ~(T5//S//NE)^ 
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January 14, 2009, confirming much of NSD's understanding and providing some 
additional information. See id. at 27. 

Following additional discussions between NSD and NSA, a preliminary notice of 
compliance incident was filed with the Court on January 15, 2009. See id. at 27-28. The 
letter reported that the alert list contained counterterrorism-associated telephone 
identifiers tasked for collection pursuant to NSA's signals intelligence (SIGINT) 
authorities under Executive Order 12333, and therefore included telephone identifiers 
that were not RAS-approved, as well as some that were. 7 Thereafter, as previously 
reported in a supplemental notice of compliance incident filed with the Court on 
February 3, 2009, NSA unsuccessfully attempted to complete a software fix to the alert 
list process so that it comported with the above requirement in docket number BR 08-13. 



7 The preliminary notice of compliance incident filed on January 15, 2009, stated in 
pertinent part: 

NSA informed the NSD that NSA places on the alert list counterterrorism 
associated telephone identifiers that have been tasked for collection pursuant to 
NSA's signals intelligence (SIGINT) authorities under Executive Order 12333. 
Because the alert list consists of SIGINT-tasked telephone identifiers, it contains 
telephone identifiers as to which NSA has not yet determined that a reasonable 
and articulable suspicion exists that they are associated wil 




As information collected pursuant the Courti s Orders in 
this matter flows into an NSA database, NSA automatically compares this 
information with its alert list in order to identify U.S. telephone identifiers that 
have been in contact with a number on the alert list. Based on results of this 
comparison NSA then determines in what body of data contact <±iaining is 
authorized. 



Jan. 15, 2009, Preliminary Notice of Compliance incident, docket number 08-13, at 2. 
(TS//SI//N 4T- 
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See id. at 20. NSA shut down the alert list process entirely on January 24, 2009, and the 
process remains shut down as of the date of this filing. 8 See id. 

II. NSA's Use of the Alert List Process to Query Telephony Metadata '(TS)^ 
When the Court initially authorized the collection of telephony metadata in 

docket number BR 06-05 on May 24, 2006, neither the Court's Orders nor the 
Government's application (including the attachments) discussed an alert list process. 
Rather, a description of the alert list process first appeared in the NSA report 
accompanying the renewal application in BR 06-08, filed with the Court on August 18, 



8 The supplemental notice of compliance incident filed on February 3, 2009, stated in 

pertinent part: 

On January 23, 2009, NSA provided the NSD with information regarding the 
steps it had taken to modify the alert list process in order to ensure that only 
"RAS-approved" telephone, identifiers run against the data collected pursuant to 
the Court's Orders in this matter (the "BR data") would generate automated 
alerts to analysts. Specifically, NSA informed the NSD that as of January 16, 2009, 
it had modified the alert list process so that "hits" in the BR data based on non- 
RAS-approved signals intelligence (SIGINT) tasked telephone identifiers would 
be automatically deleted so that only hits in the BR data based on RAS-approved 
telephone identifiers would result in an automated alert being sent to analysts. 

NSA also indicated that it was in the process of constructing a new alert list 
consisting of only RAS-approved telephone identifiers. 

On January 24, 2009, NSA informed the NSD that it had loaded to the business 
record alert system a different list of telephone identifiers than intended. NSA 
reports that, due to uncertainty as to whether all of the telephone identifiers 
satisfied all the criteria in the business records order, the alert list process was 
shut down entirely on January 24, 2009. 

Feb, 3, 2009, Supplemental Notice of Compliance incident, docket number 08-13, at 1-2. 

4TS//ST//NF) 
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2006. 9 The reports filed with the Court incorrectly stated that the alert list did not 
include telephone identifiers that were not RAS-approved. In fact, the majority of 
telephone identifiers on the list were not RAS-approved. See Alexander Decl. at 4, 7-8. 
-f T5//SI//MF) 

A. Creation of the Alert List for BR Metadata in May 2006^tB)^ 

Before the Court issued its Order in BR 06-05, NSAhad developed an alert list 
process to assist NSA in prioritizing its review of the telephony metadata it received. 

See id. at 8. The alert list contained telephone identifiers NSA was targeting for SIGINT 
collection and domestic identifiers that, as a result of analytical tradecraft, were deemed 
relevant to the Government's counterterrorism activity. See id. at 9. The alert list 
process notified NSA analysts if there was a contact between either (i) a foreign 
telephone identifier of counterterrorism interest on the alert list and any domestic 
telephone identifier in the incoming telephony metadata, or (ii) any domestic telephone 
identifier on the alert list related to a foreign counterterrorism target and any foreign 
telephone identifier in the incoming telephony metadata. See id, (TS//SI//NF) — 
According to NSA's review of its records and discussions with relevant NSA 
personnel, on May 25, 2006, NSA's Signals Intelligence Directorate (SID) asked for NSA 
Office of General Counsel's (OGC) concurrence on draft procedures for implementing 

9 Similarly, the applications and declarations in subsequent renewals did not discuss the 
alert list although the reports attached to the app lica tions and reports filed separately from 
renewal applications discussed the process.jfCS)-''''' 
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the Court's Order in docket number BR 06-05. See id. at 12. The procedures generally 
described how identifiers on the alert list would be compared against incoming BR 
metadata and provided that a supervisor would be notified if there was a match 
between an identifier on the alert list and an identifier in the incoming data. See id. at 
12-13 and Ex. B thereto ("BR Procedures") at 1-2. Moreover, a close reading of the BR 
Procedures indicated that the alert list contained both RAS-approved and non-RAS- 
approved telephone identifiers. 10 See Alexander Decl. at 12-13; BR Procedures at 1. 
NSA OGC concurred in the use of the BR Procedures, emphasizing that analysts could 
not access the archived BR metadata for purposes of conducting contact chaining^j 
mless the RAS standard had been satisfied. See Alexander Decl. at 13- 



14 and Ex. A and Ex. B thereto. 

On May 26, 2006, the chief of NSA- Washington's counterterrorism organization 
in SID directed that the alert list be rebuilt to include only identifiers assigned to "bins" 
or "zip codes" 11 that NSA used to identii 



10 For example, after describing the notification a supervisor (i.e., Shift Coordinator and, 
later. Homeland Mission Coordinator) would receive if a foreign telephone identifier generated 
an alert based on die alert list process, the BR Procedures provided that the "Shift Coordinator 
will examine the foreign number and determine if that particular telephone number has been 
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the only targets of the Court's Order in doclcet number BR 06-05. See 
Alexander Decl. at 14-15. Pursuant to this overall direction, personnel in NSA's 



counterterrorism organization actually built two lists to manage the alert process. The 
first list — known as the "alert list" — included all identifiers (foreign and domestic) 
that were of interest to counterterrorism analysts who were charged with tracking U| 

list was used to compare the incoming BR metadata NSA 
was obtaining pursuant to the Court's Order and NSA's other sources of SIGINT 
collection to alert the counterterrorism organization if there was a match between a 
telephone identifier on the list and an identifier in the incoming metadata. See id. at 15. 
The alert list consisted of two partitions —one of RAS-approved identifiers that could 
result in automated chaining in the BR metadata and a second of non-RAS approved 
identifiers that could not be used to initiate automated chaining in the BR metadata. 

See id. The second list— known as the "station table" —was a historical listing of all 
telephone identifiers that had undergone a RAS determination, including the results of 
the determination. See id, at 15, 22. NSA used the "station table" to ensure that only 
RAS-approved "seed" identifiers were used to conduct chaining in 
the BR metadata archive. See id. at 15. In short, the system was designed to compare 
both SIGINT and BR metadata against the identifiers on -the alert list but only to permit 



A chart of the alert list process as it operated from May 2006 to January 2009 is attached 
to the Alexander Declaration as Ex. 
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alerts generated from RAS-approved telephone identifiers to be used to conduct contact 
chaining the BR metadata. As a result, the majority of telephone 

identifiers compared against the incoming BR metadata in the rebuilt alert list were not 
RAS-approved. See id. at 4, 7-8. For example, as of January 15, 2009, the date of NSD's 
first notice to the Court regarding this issue, only 1,935 of the 17,835 identifiers on the 
alert list were RAS-approved. See id. at 8 . (T5//5I//NF) 

Based upon NSA's recent review, neither NSA SID nor NSA OGC identified the 
inclusion of non-RAS-approved identifiers on the alert list as an issue requiring 
extensive analysis. See id. at 11. Moreover, NSA personnel, including the OGC 
attorney who reviewed the BR Procedures, appear to have viewed the alert process as 
merely a means of identifying a particular identifier on the alert list that might warrant 
further scrutiny, including a determination of whether the RAS standard had been 
satisfied and therefore whether contact chaining could take place in 

the BR metadata archive using that particular identifier. 12 See id, at 11-12. In fact, NSA 
designed the alert list process to result in automated chaining of the BR metadata only if 
the initial alert was based on a RAS-approved telephone identifier, See id. at 14. If an 

12 As discussed in the Alexander Dedaration, in the context of NSA's SIGINT activities 
the term "archived data" normally refers to data stored in NSA's analytical repositories and 
exdudes the many processing steps NSA undertakes to make the raw collections useful to 
analysts. Accordingly, NSA analytically distinguished the initial alert process from the 

subsequent process o£ performing contact ( i.e„ "queries") of the 

"archived data," assessing that the Court's Orderin docket number BR 06-05 only governed the 
latter. See Alexander Decl.' at 3-4, 10-15. (TS//SI//NF) 
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alert was based on a non-RAS-approved identifier, no automated chaining would occur 
In the BR metadata archive although automated chaining could occur in other NSA 
archives that did not require a RAS determination (e.g„ non-FISA telephony collection). 
See id.Tr577gmia ^ 

B. Description of the Alert List Process Beginning in August 2006 
The first description of the alert list process appeared in the NSA report 
accompanying the Government's renewal application filed with the Court on August 18, 
2006. The report stated in relevant part: 

_4TS//S3//NF)AJS A has compiled through its continuous counter- 
terrorism analysis, a list of telephone numbers that constitute an "alert 
list" of telephone numbers used by members of 

alert list serves as a body of 

telephone numbers employed to query the data, as is described more fully 
below. 

____hIS//Sl//Nh)' Domestic numbers and foreign numbers are treated 
differently with respect to the criteria for including them on the alert list. 

With respect to fo reign telephone numbers, NSA receives information 

indicating a tie 

Principal among these are: 



|Each of the foreign telephone numbers that comes 
to the attention of NSA as possibly related 

evaluated to determine whether the 

information about it provided to NSA satisfies the reasonable articulable 
suspicion standard. If so, the foreign telephone number is placed on the 
alert list; if not, it is not placed on the alert list. 

£TS//SI//NF) The process set out-above.applies also to newly - 
discovered domestic telephone numbers considered for addition to the 
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alert list, •with the additional requirement that NSA's Office of General 
Counsel reviews these numbers and affirms that the telephone number is 
not the focus of the analysis based solely on activities that are protected by 
the First Amendment, . . . 

- (TS//DI//NF) As of the last day of the reporting period addressed 
herein, NSA had included a total of 3980 telephone numbers on the alert 
list, which includes foreign numbers and domestic numbers, after 
concluding that each of the foreign telephone numbers satisfied the 
standard set forth in the Court's May 24, 2006 [Order], and each of the 
domestic telephone numbers was either a FISC approved number or in 
direct contact with a foreign seed that met those criteria. 

(TS//PT//hTF)---T n summarize the alert system: every day new 
contacts are automatically revealed with the 3980 telephone numbers , 
contained on the alert list described above, which themselves are present 
on the alert list either because they satisfied the reasonable articulable 
suspicion standard, or because they are domestic numbers that were 
either a FISC approved number or in direct contact with a number that 
did so. These automated queries identify any new telephone contacts 
between the numbers on the alert list and any other number, except that 
domestic numbers do not alert on domestic-to-domestic contacts. 

NSA Report to the FISC (Aug. 18, 2006), docket number BR 06-05 (Ex. B to the 

Government's application in docket number BR 06-08), at 12-15 ("August 2006 

Report"). 13 The description above was included in similar form in all subsequent 

reports to the Court, including the report filed in December 2008. "^TSTTSIZ/ME)^ 



13 The August 2006 report also discussed two categories of domestic telephone numbers 
that were added to the alert list prior to the date the Order took effect. One category consisted 
of telephone numbers for which the Court had authorized collection and were therefore 
deemed approved for metadata querying without the approval of an NSA official. The second 
category consisted of domestic numbers added to the alert list after direct contact with a known 
foreign seed number. The. domestic numbers were not used as seeds themselves and 

contact chaining was limited to two hops (instead of the three hops authorized by the Court). 
See August 2006 Report, at 12-13; Alexander Decl. at Zxi.l. ,.NSA subsequently removed the 
numbers in the second category from the alert list, f TSffSiffNE)^ 
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According to NSA's review of its records and discussions with relevant NSA 
personnel tire NSA OGC attorney who prepared the initial draft of the report included 




attorneys and operational personnel and requested that others review it for accuracy. 
See id. The inaccurate description, however, was not corrected before tire report was 
finalized and filed with the Court on August 18, 2006. Tire same description remained 
in subsequent reports to the Court, including the report filed in docket number BR OS- 
13. 14 ( T S //Sl//rfl7)- 



14 At the meeting on January 9, 2009, NSD and NSA also identified that the reports filed 
with the Court have incorrectly stated the number of identifiers on the alert list. Each report 
included the number of telephone identifiers purportedly on the alert list. See, e.g,. NSA 120- 
Day Report to the FISC (Dec. 11, 2008), docket number BR 08-08 (Ex. B to the Government's 
application in docket number BR 08-13), at 11 ("As of November 2, 2008, tire last day of the 
reporting period herein, NSA had included a total of 27,090 telephone identifiers on the alert 
list . . . ."). In fact, NSA reports that these numbers did not reflect the total number of identifiers 
on tire alert list; they actually represented the total number of identifiers included on the 
"station table" (NSA's historical record of RAS determinations) as currently RAS-approved (i.e.. 
approved for contact See Alexander Decl. at 8 n.3. (TS//SI//NF) 
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DISCUSSION (U) 

I. THE COURT'S ORDERS SHOULD NOT BE RESCINDED AND NEED NOT 
BE MODIFIED 

In the January 28 Order, the Court directed the Government to submit a written 
brief designed to, among other things, assist the Court in. assessing whether the Primary 
Order in docket number BR 08-13 should be modified or rescinded. 15 January 28 Order 

a t 2,X 

So long as a court retains jurisdiction over a case, then, in the absence of a 
prohibition by statute or rule, the court.retains inherent authority to "reconsider, 
rescind, or modify an interlocutory order for cause seen by it to be sufficient." 

Melancon v. Texaco. Inc. r 659 F.3d 551, 553 (5th Cir, 1981). The choice of remedies rests 
in a court's sound discretion, see Kingsley v. United States. 968 F.2d 109, 113 (1st Cir. 
1992) (citations omitted) (considering the alternative remedies for breach of a plea 
agreement), but in exercising that discretion a court may consider the full consequences 
that a particular remedy may bring about, see Alrefae v. Chertoff, 471 F.3d 353, 360 (2d 
Cir. 2006) (citations omitted) (instructing that on remand to consider petitioner's motion 
to rescind order of removal, immigration judge may consider "totality of the 
circumstances"). Consonant with these principles, prior decisions of this Court reflect a 
strong preference for resolving incidents of non-compliance through the creation of 

15 The authorization granted by the Primary Order issued by the Court in docket 
number BR 08-13 expires on March 6, 2009 at 5:00 p.m, Eastern Time. (T5//5I//NP ) 
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(prohibiting the querying of data using "seed" accounts validated using particular 
information). ~ frS//5I//NT) 

The Court's Orders in this matter did not authorize the alert list process as 
implemented to include a comparison of non-RAS- approved identifiers against 
incoming BR metadata. However, in light of the significant steps that the Government 
has already taken to remedy the alert list compliance incident and its effects, the 
significant oversight modifications the Government is in the process of implementing, 
and die value of die telephony metadata collection to the Government's national 



security mission, the Government respectfully submits tiiat the Court should not 
rescind or modify the authority granted in docket number BR 08-13. 
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A, Remedial Steps Already Undertaken by the Government Are Designed 
to Ensure Future Compliance with the Court's Orders and to Mitigate 
Effects of Past Non-Compliance 

Since the Government first reported this matter to the Court, NSA has taken 
several corrective measures related to the alert process, including immediate steps to 
sequester and shut off its analysts' access to any alerts that were generated from 
comparing incoming BR metadata against non-RAS-approved identifiers. See 
Alexander Decl, at 19-20. NSA also immediately began to re-engineer the entire alert 
process to ensure that only RAS-approved telephone identifiers are compared against 
incoming BR metadata. See id. Most importantly, NSA shut off the alert list process on 
January 24, 2009, when its redesign efforts failed, and the process will remain shut 
down until the Government can ensure that the process will operate within the terms of 
the Court's Orders. See id. at 20. - (TS//5I//NE J — 

NSA has also conducted a review of all 275 reports NSA has disseminated since 
May 2006 as a result of contact NSA's archive of 

BR metadata. 16 See id. at 36. Thirty-one of these reports resulted from the automated 
alert process. See id. at 36 n.17. NSA did not identify any report that resulted from the 
use of a non-RAS-approved "seed" identifier. 17 See id. at 36-37. Additionally, NSA 

16 A single report may tip more than one telephone identifier as being related to the seed 
identifier. As a result, the 275 reports have tipped a total of 2,549 telephone identifiers since 
May 24, 2006. See Alexander Decl. at 36 n.17. (T5//SI//NF) — 

17 NSA has identified one report where the-number on the alert list was not RAS- 
approved when the alert was generated but, after receiving the alert, a supervisor determined 
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determined that in all instances where a U.S. identifier served as the initial seed 
identifier for a report (22 of the 275 reports), the initial U.S. seed identifier was either 
already the subject of FISC- approved surveillance under the FISA or had been reviewed 
by NSA's OGC to ensure that the RAS determination was not based solely on a U.S. 
person's first amendment-protected activities. See id. at 37. 

Unlike reports generated from the BR metadata, which NSA disseminated 
outside NSA, the alerts generated from a comparison of the BR metadata to the alert list 
were, only distributed to NSASIGINT personnel responsible for counterterrorism 
activity. 18 See id. at 38. Since this compliance incident surfaced, NSA identified and 
eliminated analyst access to all alerts that were generated from the comparison of non- 
RAS approved identifiers against the incoming BR metadata and has limited access to 
the BR alert system to only software developers assigned to NSA's Homeland Security 
Analysis Center (HSAC), and the Technical Director for the HSAC. See id. at 38-39. 






that the identifier, in fact, satisfied the RAS standard. After this determination, NSA used the 
identifier as a seed for draining in the BR FISA data archive. Information was developed that 
led to a report to the FBI that tipped 11 new telephone identifiers. See Alexander Ded. at 37 
n.l8,lTS?yS^NE). 

18 Initially, if an identifier on the alert list generated an alert that the identifier had been 
in contact with an identifier in the United States, the alert system masked fi.e., concealed from 
the analysfi s view) the domestic identifier. Later, in January 2008, the SIGINT Directorate 
allowed the alerts to be sent to analysts without masking the domestic identifier. NSA made 
this change in an effort to improve the ability of SIGINT .analysts, on the basis of their target 
knowledge, to prioritize their work more efficiently. See Alexander Deck at 38r- (TS//DI//NF) — 



TOP SF.CRET//COMINT//NQFOBN//MR 
18 



In addition to the steps NSA has talcen with respect to the alert list issues, NSA 
has also implemented measures to review NSA's handling of the BR metadata generally. 
For example, the Director of NSA has ordered end-to-end system engineering and 
process reviews (technical and operational) of NSA's handling of BR metadata. See id. 
at 21. The results of dus review will be made available to the Court. See id. at 21 n.13. 

In response to this Order, NSA also has undertaken the following: 

o a review of domestic identifiers on the "station table" in order to confirm 
that RAS determinations complied with the Court's Orders; and 

® an audit of all queries made of the BR metadata repository since 

November 1, 2008, to determine if any of the queries during that period 
were made using non-RAS-approved identifiers. 19 

See id. at 22-23 rfTSffStffNF ) — 

To better ensure that NSA operational personnel understand the Court-ordered 
procedures and requirements for accessing the BR metadata, NSA's SIGINT Oversight & 
Compliance Office also initiated an effort to redesign training for operational personnel 
who require access to BR metadata. This effort will include competency testing prior to 
access to die data. See id. at 23, In die interim, NSA management personnel, with 
support from NSA OGC and the SIGINT Oversight and Compliance Office, delivered 

19 Although NSA's review is still ongoing, NSA's review to date has revealed no 
instances of improper querying of the BR metadata, aside from those previously reported to the 
Court in a notice of compliance incident filed on January 26, 2009, in which it was reported that 
between approximately December 10, 2008, and January 23, 2009, two analysts conducted 280 
queries using non-RAS-approved identifiers. See Alexander Ded. at 22-23. As discussed below, 
NSA is implementing software changes to the query tools used by analysts so. that only RAS- 
approved identifiers may be used to query the BR FISA data repository. See id. at 22-23. 
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in-person briefings for all NSA personnel who have access to the BR metadata data 
archive to remind them of the requirements and their responsibilities regarding the 
proper handling of BR metadata, See id. In addition, all NSA personnel with access to 
the BR metadata have also received a written reminder of their responsibilities. See id. 
- fT Sf /SI//NF) 

Finally, NSA is implementing two changes to the tools used by analysts to access 
die BR metadata. First, NSA is changing the system that analysts use to conduct contact 
chaining of the BR metadata so that the system will not be able to accept any non-RAS- 
approved identifier as the seed identifier for contact chaining. See id, at 24. Second, 

NSA is implementing software changes to its system that will limit to three the number 
of "hops" permitted from a RAS-approved seed identifier. See id, (TS//SI//N F) 

B. Additional Oversight Mechanisms the Government Will Implement~(S)-— 

The operation of the alert list process in a manner not authorized by the Court 

and contrary to the manner in which it was described to tine Court is a significant 
compliance matter. While the process has been remedied in the ways described above, 
the Government has concluded that additional oversight mechanisms are appropriate to 
ensure future compliance with the Primary Order in docket number BR 08-13 and any 
future orders renewing the authority granted therein, Accordingly, the Government 
will implement the following oversight mechanisms in addition to those contained in 
the Court's Orders: 
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® NSA's OGC will consult with NSD on all significant legal opinions that relate to 
the interpretation, scope and/or implementation of the authorization granted by 
the Court in its Primary Order in docket number BR 08-13, prior Orders issued 
by the Court, or any future order renewing that authorization. When 
operationally practicable, such consultation shall occur in advance; otherwise 
NSD will be notified as soon as practicable; 

® NSA's OGC will promptly provide NSD with copies of the mandatory 

procedures (and all replacements, supplements or revisions thereto in effect now 
or adopted in the future) the Director of NSA is required to maintain to strictly 
control access to and use of the data acquired pursuant to orders issued by the 
Court in this matter; 

o NSA's OGC will promptly provide NSD with copies of all formal briefing and/or 
training materials (including all revisions thereto) currently in use or prepared 
and used in the future to brief/train NSA personnel concerning tire authorization 
granted by orders issued by the Court in this matter; 

e At least once before any future orders renewing the authorization granted in 
docket number BR 08-13 expire, a meeting for the purpose of assessing 
compliance with this Court's orders will be held with representatives from 
NSA's OGC, NSD, and appropriate individuals from NSA's Signals Intelligence 
Directorate. The results of this meeting will be reduced to writing and submitted 
to the Court as part of any application to renew or reinstate this authority; 

• At least once during the authorization period of all future orders, NSD will meet 
with NSA's Office of Inspector General (OIG) to discuss their respective 
oversight responsibilities and assess NSA's compliance with tire Court's orders 
in this matter; 

© Prior to implementation, all proposed automated query processes will be 
reviewed and approved by NSA's OGC and NSD. 

(TS//SI//NF) 



While no oversight regime is perfect, the Government submits drat this more 
robust oversight regime will significantly reduce the likelihood of such compliance 



incidents occurring in the futureW(TS)^ 
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C. The Value of the BR Metadata to the Government s National Security 
Mission'^TS^ 

The BR metadata plays a critical role in the Government's ability to find and 

identify members agents 

As discussed in declarations previously filed with 

use ^Vernational telephone system to 
communicate with one another between numerous countries all over the world, 
including to and from the United States. Access to the accumulated pool of BR 
metadata is vital to NSA's counterterrorism intelligence mission because it enables NSA 
to discover tire commiinications of -these terrorist operatives. See Alexander Ded. at 39- 
42. While terrorist operatives often take intentional steps to disguise and obscure theft 
communications and their identities using a variety of tactics, by employing its contact 
chaining against the accumulated pool of metadata NSA can 

discover valuable information about the adversary. See id. Specifically, using contact 
draining may be able to discover previously unknown 

telephone identifiers used by a known terrorist operative, to discover previously 
unknown terrorist operatives, to identify hubs or common contacts between targets of 
interest who were previously thought to be unconnected, and potentially to discover 
individuals willing to become U.S. Government assets. See, e.g., Ded. of Lt. Gen. Keith 
B. Alexander, docket number BR 06-05, Ex. A at *][ 9; Ded. o^^^^^^^^^^Hiocket 
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number BR 08-13, Ex. A at H 9-11. 20 Such discoveries are not possible when targeting 
solely known terrorist telephone identifiers. See Alexander Decl. at 39-40. 
Demonstrating the value of the BR metadata to the U.S. Intelligence Community, the 
NS A has disseminated 275 reports and tipped over 2,500 telephone identifiers to the FBI 
and CIA for further investigative action since the inception of this collection in docket 
number BR 06-05. See icL at 42. This reporting has provided the FBI with leads and 
linkages on individuals in the U.S. with connections to terrorism that it may have 
otherwise not identified. See id.TTB7/gf//NjR — 

In summary, tire unquestionable foreign intelligence value of this collection, the 
substantial steps NS A has already taken to ensure the BR metadata is only accessed in 
compliance with the Court's Orders, and the Government's enhanced oversight regime 
provide the Court with a substantial basis not to rescind or modify the authorization for 
this collection program. 

III. THE COURT NEED NOT TAKE ADDITIONAL ACTION REGARDING 
MISREPRESENTATIONS THROUGH ITS CONTEMPT POWERS OR BY 
REFERRAL TO APPROPRIATE INVESTIGATIVE OFFICES 

The January 28 Order asks "whether the Court should take action regarding 
persons responsible for any misrepresentation to the Court or violation of its Orders, 



20 Other advantages of contact chaining include 



T] 
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either through its contempt powers or by referral to the appropriate investigative 
offices." January 28 Order at 2. The Government respectfully submits that such actions 
are not required. Contempt is not an appropriate remedy on these facts, and no referral 
is required, because NSA already has self-reported this matter to the proper 
investigative offices. 

Whether contempt is civil or criminal in nature turns on the "character and 
purpose" of the sanction involved. See IntT Union. United Mine Workers of Am. v. 
Bagwell. 512 U.S. 821, 827 (1994) (quoting Gompers v. Bucks Stove & Range Co., 221 
U.S. 418, 441 (1911)), Criminal contempt is punitive in nature and is designed to 
vindicate the authority of the corut. Seg Bagwell, 512 U.S. at 828 (internal quotations 
and citations omitted). It is imposed retrospectively for a "completed act of 
disobedience," and has no coercive effect because the contemnor cannot avoid or 
mitigate the sanction through later compliance. Id. at 828-29 (citations omitted). 21 
Because NSA has stopped the alert list process and corrected tire Agency's unintentional 
misstatements to the Court, any possible contempt sanction here would be in the nature 
of criminal contempt^(T57)S^/NJ)^ 



21 By contrast, civil contempt is "remedial, and for the benefit of the complainant." 
Gompers, 221 U.S. at 441. It "is ordinarily used to compel compliance with an order of the 
court," Cobell v. Norton, 334 F,3d 1128, 1145 (D.C, Cir. 2003), and may also be designed "to 
compensate the complainant for losses sustained.' MJnited States v. United Mine Workers of 
America, 330 U.S. 258, 303-04 (1947) (citations omitted). (U) 
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A finding of criminal contempt '''requires both a contemptuous act and a 
wrongful state of mind." Cobell. 334 F.3d at 1147 (citations omitted). The violation of 
the order must be willful: "a volitional act by one who knows or should reasonably be 
aware that his conduct is wrongful." United States v. Greyhound Corp.. 508 F.2d 529, 
531-32 (7th Cir. 1974), quoted in In re Holloway. 995 F.2d 1080, 1082 (D.C. Cir. 1993) 
(emphasis in original). For example, a criminal contempt conviction under 18 U.S.C. § 
401 requires, among other things, proof of a willful violation of a court order; La, where 
the defendant "acts with deliberate or reckless disregard of the obligations created by a 
court order." United States v. Rapone. 131 F.3d 188, 195 (D.C. Cir. 1997 ) (citations 
omitted). 22 (U) 

Here, there are no facts to support the necessary finding that persons at NSA 
willfully violated the Court's Orders or intentionally sought to deceive the Court. To 
the contrary, NSA operational personnel implemented the alert list based on the 
concurrence of its OGC to a set of procedures that contemplated comparing tire alert 
list, including non-RAS-approved telephone identifiers, against a flow of new BR 
metadata. See Alexander Decl. at 12-14. The concurrence of NSA's OGC was based on 
NSA's understanding that, by using the term "archived data," the Court's Order in 

22 A person charged with contempt committed out of court is entitled to the usual 
protections of criminal law, such as the presumption of innocence and the right to a jury trial. 
Bagwell. 512 U.S. at 827-28. For criminal contempt to apply, a willful violation of an order must 
be proved beyond a reasonable doubt. See id. Contempt occurring in the presence of the Court, 
however, is not subject to all such protections. Seg id. at 827 n.2. (U) 
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docket number BR 06-05 only required the RAS standard to be applied to the contact 
chaining^^^^^^^^^^H conducted by accessing NSA's analytic repository of BR 
metadata. See id. at 10-14. This advice was given for die purpose of advising NSA 
operators on how to comply with die Court's Orders when using an alert list. Its goal 
plainly was not to deliberately or recklessly disregard those Orders; and in heeding this 
advice, NSA operators were not themselves seeking to deliberately or recklessly 
disregard the Court's Orders. Indeed, the NSA attorney who reviewed the procedures 
added language to the procedures to emphasize the Court's requirement that the RAS 
standard must be satisfied prior to conducting any chairdng^^^^^^^^^^of NSA's 

analytic repository of BR metadata. See id at 13-14. (TS//SI//NF) 

NSA OGC's concurrence on the procedures the SIGINT Directorate developed for 
processing BR metadata also established the framework for numerous subsequent 
decisions and actions, including the drafting and reviewing of NSA's reports to the 
Court. NSA personnel reasonably believed, based on NSA OGC's concurrence with the 
BR Procedures, that the queries subject to the Court's Order were only contact chaining 

of die aggregated pool of BR metadata. Against diis backdrop, 
NSA operational personnel reasonably believed that, until contact chaining of the 
aggregated pool of BR metadata was conducted, the alert list process was not subject to 
the RAS requirement contained in the Court's Order. This, in turn, led to the 
misunderstanding between the NSA attorney who prepared the initial draft of NSA's 
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first BR report to tire Court and the individual in the SIGINT Directorate who served as 
the report's primary reviewer, so that ultimately the report contained an incorrect 
description of the alert list process. See id. at 16-18. 23 In other words, there was no 
deliberate effort to provide inaccurate or misleading information to the Court, nor did 
any NS A employee deliberately circumvent the RAS requirement contained in the 
Court's Orders. Based on this confluence of events, all parties involved in the drafting 
of the report believed the description of the alert list to be accurate. (TS//GI//NF)_ 

In addition, the Government has already taken steps to notify the appropriate 
investigative officials regarding this matter. Specifically, FBI's OGC was informed of 
this matter on January 23, 2009; the Director of National Intelligence was informed of 
this matter on January 30, 2009, and received additional information about the incident 
on two other occasions; and the Undersecretary of Defense for Intelligence was 
informed of this matter on February 10, 2009. See id. at 28-29. NSAhas also notified its 
Inspector General of this matter. See id. at 28. Finally, NS A is in the process of formally 
reporting this matter to the Assistant Secretary of Defense for Intelligence Oversight 
and subsequently the President's Intelligence Oversight Board. See id. at 28-29. (S) 



23 As described above, the alert list actually consisted of two partitions -one of RAS- 
approved identifiers that could result in automated chaining in the BR metadata and a second 
of non-RAS approved identifiers that could notbe-usedio initiate automated chaining in the BR 
metadata. See Alexander Ded. at 15. "(T577SI//N-ES — 
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CONCLUSION (U) 

For the reasons provided above, while the Government acknowledges that its 
descriptions of the alert list process to the Court were inaccurate and that the Court's 
Orders in this matter did not authorize the alert list process as implemented, the Court 
should not rescind or modify its Order in docket number BR 08-13 or take any further 
remedial action.~ff5//S3#MEX 

Respectfully submitted. 




Acting Assistant Attorney General 




Office of Intelligence 



National Security Division 
United States Department of Justice 
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UNITED STATES 

FOREIGN INTELLIGENCE SURVEILLANCE COURT 
WASHINGTON, D.C. 




DECLARATION OF LIEUTENANT GENERAL KEITH B. ALEXANDER, 

UNITED STATES ARMY, 

DIRECTOR OF THE NATIONAL SECURITY AGENCY 



(U) I, Lieutenant General Keith B. Alexander, depose and state as follows: 

(U) I am the Director of the National Security Agency (“NS A” or “Agency”), an 
intelligence agency within the Department of Defense (“DoD”), and have served in this 
position since 2005. I currently hold the rank of Lieutenant General in the United States 
Army and, concurrent with my current assignment as Director of the National Security 
Agency, I also serve as the Chief of the Central Security Service and as the Commander 
of the Joint Functional Component Command for Network Warfare. Prior to my current 
assignment, I have held other senior supervisory positions as an officer of the United 

i 

States military, to include service as the Deputy Chief of Staff (DCS, G-2), Headquarters, 
Department of the Army; Commander of the US Army’s Intelligence and Security 
Command; and the Director of Intelligence, United States Central Command. 
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(S) As the Director of the National Security Agency, I am responsible for 
directing and overseeing all aspects ofNSA’s cryptologic mission, which consists of 
three functions; to engage in signals intelligence (“SIGINT”) activities for the US 
Government, to include support to the Government's computer network attack activities; 
to conduct activities concerning the security of US national security telecommunications 
and information systems; and to conduct operations security training for the US 
Government. Some of the information NS A acquires as part of its SIGINT mission is 
collected pursuant to Orders issued under the Foreign Intelligence Surveillance Act of 
1978, as amended (“FISA”). 

(U) The statements herein axe based upon my personal knowledge, information 
provided to me by my subordinates in the course of my official duties, advice of counsel, 
and conclusions reached in accordance therewith. 

I. (U) Purpose : 

(S//SI//NF) This declaration responds to the Court’s Order of 28 January 2009 
(“BR Compliance Order”), which directed the Government to provide the Foreign 
Intelligence Surveillance Court (“FISC” or “Court”) with information “to help the Court 
assess whether the Orders issued in this docket should be modified or rescinded; whether 
other remedial steps should be directed; and whether the Court should take action 
regarding persons responsible for any misrepresentations to the Court or violations of its 
Orders, either through its contempt powers or by referral to appropriate investigative 
offices.” 
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— (S/MF) T o this end, this declaration describes the compliance matter that gave 
rise to the BR Compliance Order; NSA’s analysis of the underlying activity; the root 
causes of the compliance problem; the corrective actions NS A has taken and plans to take 
to avoid a reoccurrence of the incident; answers to the seven (7) specific questions the 
Court has asked regarding the incident; and a description of the importance of this 
collection to the national security of the United States. 

II. (U) Incident : 

A..(U) Summary 

(TS/7SI//NF) Pursuant to a series of Orders issued by the Court since May 2006, 
NS A has been receiving telephony metadata from telecommunications providers. NSA 
refers to the Orders collectively as the “Business Records Order” or “BR FISA.” With 
each iteration of the Business Records Order, the Court has included language which says 
“access to the archived data shall occur only when NSA has identified a known 
telephone identifier for which . there are facts giving rise to a reasonable articulable 
suspicion that the telephone identifier is associated with . .N- ' : ' . 




Docket BR 08-13, Primary Order, 12 December 2008, emphasis added . For reasons 
described in more detail in the Section III. A. of this declaration, NSA personnel 
understood the term “archived data” to refer to NSA’s analytic repository of BR FISA 
metadata and implemented the Business Records Order accordingly. 
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(TS//SI//NF )-While NS A did not authorize contact chaining 
occur in the Agency’s analytic repository of BR FISA material unless NS A had 
determined that the “seed” telephone identifier for the chaining 

satisfied the reasonable articulable suspicion (“RAS”) standard specified in the. Order, in 
its reports to the Court regarding NSA’s implementation of the Business Records Order, 
the Agency incorrectly described an intermediate step called the alert process that NSA 
applied to the incoming stream of BR FISA metadata. The alert process would notify 
counterterrorism (CT) analysts if a comparison of the incoming metadata NSA was 
receiving from the Business Records Order and other sources of SIGINT collection 
revealed a match with telephone identifiers that were on an alert list of identifiers that 
were already of interest to CT personnel. 

(TS//SFMF) In its reports to the Court, NSA stated the alert list only contained 
telephone identifiers that satisfied the RAS standard. In reality, the majority of identifiers 
on tire alert list were CT identifiers that had not been assessed for RAS. If one of these 
non-RAS approved identifiers generated an alert, a CT analyst was notified so that NSA 
could make a RAS determination. If the Agency determined the identifier satisfied the 
RAS standard, only then would the identifier be approved as a seed for contact chaining 
in the Agency’s BR FISA analytic repository (/. e., the “archived 
data”). If tire contact chaining ^^^^^^^^^^roduced information of foreign 
intelligence value, an NSA analyst would issue a report. In other words, none of NSA’s 
BR FISA reports were based on non-RAS approved identifiers across the period in 
question - May 2006 through January 2009. ■ 
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— (S//SI) I wish to emphasize that neither I nor the Agency is attempting to 
downplay the significance of NSA’ s erroneous description of die alert process to the 
Court. In retrospect, the Business Records Order did not provide NSA with specific 
authority to employ the alert list in the manner in which it did. The Agency’s failure to 
describe the alert process accurately to the Court unintentionally precluded the Court 
from determining for itself whether NSA was correctly implementing the Court’s Orders. 
Although I do not believe that any NSA employee intended to provide inaccurate or 
misleading information to the Court, I fully appreciate the severity of this error. 



B. (U) Details 

(TS//ST/YNF) Pocket BR 08-13 is the FISC’s most recent renewal of authority first 
granted to the Government in May 2006 to receive access to business records in the form 
of telephone call detail records. See Docket BR 06-05, 24 May 2006. NSA developed 
the automated alert process to notify NSA analysts of contact between a foreign 
telephone identifier of counterterrorism interest and any domestic telephone identifier; or 
any contact between a domestic telephone identifier, related to a foreign counterterrorism 
target, and any foreign telephone identifier. In its first BR FISA report to the Court in 
August 2006, the Agency described the automated alert process as follows: 



~(TS//DR'1 | IT)-NSA has compiled through its continuous counter- 
terrorism analysis, a list of telephone numbK^fra^onstifrt^iChlaf list” 

of telephone numbers used by members of 

This alert list serves as a body of 
telephone numbers employed to query the data, as is described more fully 
below. 

~~(TS#STyh[E) Domestic numbers and foreign numbers are treated 
differently with respect to the criteria forincludmg them on the alert list. - 
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telephone numbers. NSA receives information 



With respect to foreh 
indicating a tie to| 
from a variety of sources. Principal among these are: I 




Each of the foreign tebphon^nmba^iatcomes 
t^&^^eirtioi^^S^a^ossibly related to 

evaluated to detennine whether the 

information about it provided to NSA satisfies the reasonable articulable 
suspicion standard. If so, the foreign telephone number is placed on the 
alert list; if not, it is not placed on the alert list, 

— (TS//SLVNF) The process set out above applies also to newly 
discovered domestic telephone numbers considered for addition to the 
alert list, with the additional requirement that NSA’s Office of General 
Counsel reviews these numbers and affirms that the telephone number is 
not the focus of the analysis based solely on activities that are protected by 
the First Amendment. There are, however, two categorie^fdomesti^, 
telephon^iumbe^diat were added to the NSA alert list 
^^^^mUmand the basis for their additions slightly different. 

(TS//SI//NF) The first category consists, of H domestic numbers 
that are currently the subject of FISC authorized electronic surveillance 
based on the FISC’s finding of probable cause to believe that they are used 
by agents of | 

Since these numbers were already reviewed and authorized by the Court 
for electronic surveillance purposes, they were deemed approved for meta 
data querying without the approval of an NSA official.^^ 

~ (TS//DI//NF) The second category consists of ^Jdomestic 
numbers each of wW^ma^dde^^ieNS^^er^is^ftg^gming.to 
NSA’s attentic 

ad subsequent NSA analysis produced a sufficient 

level of suspicion that NSA generated an intelliaenc^repo^bou^he 
telephone number to the FBI and tl 
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(TS// SI//NF) -However, in order to avoid any appearance of 
circumventing the procedures, NSA will change its software to build the 
chains from the original foreign number and remove the domestic 
numbers described above from the alert list. While the software is being 
developed, which will take approximately 45 days, NSA will continue to 
run the domestic numbers on the alert list as described. 1 - 1 - 1 

(T3//5I//NF) As of the last day of the reporting period addressed 
herein, NSA had included a total of 3980 telephone numbers on the alert 
list, which includes foreign numbers and domestic numbers, after 
concluding that each of the foreign telephone numbers satisfied the 
standard set forth in the Court’s May 24, 2006, and each of the domestic 
telephone numbers was either a FISC approved number or in direct 
contact with a foreign seed that met those criteria. 

WTS^Si//NE)~To summarize the alert system: every day new 
contacts are automatically revealed with the 3980 telephone numbers 
contained on the alert list described above, which themselves are present 
on the alert list either because they satisfied the reasonable articulable 
suspicion standard, or because they are domestic numbers that were either 
a FISC approved number or in direct contact with a number that did so. 

These automated queries identify any new telephone contacts between the 
numbers on die alert list and any other number, except that domestic 
numbers do not alert on domestic-to-domestic contacts. 

• (TS//SI//NF) D uring this reporting period, a combination of die 
alert system and queries resulting from leads described below in paragraph 
two led to analysis that resulted in the discovery of 138 new numbers that 
were tipped as leads to the FBI and the CIA as suspicious telephone 
numbers. 

See Docket BR 06-05, NSA Report to the FISC, August 18, 2006, at 12-16 (footnote 
omitted). Subsequent NSA reports to the Court contained similar representations as to 
the functioning of the alert list process. See, e.g.. Docket BR 08-08, NSA 120-Day 
Report to the FISC, December 11, 2008, at 8-12. 



_j(ICS4<Si4Nffy In short, the reports filed with the Court incorrectly stated that the 
telephone identifiers on the alert list satisfied the RAS standard. In feet, the majority of 
telephone identifiers included on the alert list had not been RAS approved, although the 




TOT GECRET//COMDIT// / NOFORt4/d g S : 



- 7 -- 



1846 & 1862 PRODUCTION 5 MARCH 2009 -41 





TOP S ECRET //CO MINT / /NOFORN/ /MR 

identifiers were associated with the same class of terrorism targets covered by the 
Business Records Order. 2 Specifically, of the 17,835 telephone identifiers that were on 
the alert list on 15 January 2009 (the day DoJ reported tins compliance incident to the 
Court), only 1,935 were RAS approved. 3 

HI. (U) WSA’s Analysis : 

- ('TH/dlT/i'T in M ' m i , n m m W 

(The term “metadata'’ refers to information about 

a communication, such as routing information, date/time of the communication, etc., but 
does not encompass the actual contents of a communication.) As explained in greater 
detail in Section VITof this declaration, analysis of communications metadata can yield 
important foreign intelligence information, 




J-(Tb//GVyTir)The reports filed with the Court in this matter also incorrectly stated the number of 
identifiers on the alert list. Each report included the number of telephone identifiers purportedly on the 
alert list See, e.g., Docket BR 06-08, NSA 120-Day Report to the FISC, August 3 8, 2006, at 15 (“As of 
the last day of the reporting period addressed herein, NSA has included a total of 3980 telephone numbers 
on the alert list . , . .”); Docket BR 08-13, NSA 120-Day Report to the FISC, December 1 1, 2008, at 1 1 
(“As of November 2, 2008, the last day of the reporting period herein, NSA had included atotal of 27,090 
telephone identifiers on the alert list . . , .”). In fact, these numbers reported to the Court did not reflect the 
number of identifiers on the alert list; they actually- represented the total number of identifiers included on 
the “station table” (discussed below atpage!5) as “RAS approved/ /. e. . approved for contact chaining. 
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NS a put on 

the alert list telephone identifiers from two different sources that were of interest to 
counterterrorism personnel. The first source consisted of telephony identifiers against 
which the Agency was conducting SIGINT collection for counterterrorism reasons and 
the second source consisted of domestic telephony identifiers which, as a result of 
analytic tradecraft, were also deemed relevant to the Government’s counterterrorism 
activity. The key goal of this alert process was to notify NS A analysts if there was a 
contact between a foreign telephone identifier of counterterrorism interest and any 
domestic telephone identifier; or contact between any domestic telephone identifier, 
related to a foreign counterterrorism target, and any foreign telephone identifier. At the 
time, NS A considered this type of contact to be an important potential piece of foreign 
intelligence since such contact could be indicative of an impending terrorist attack against 
the US homeland . 4 



A. (TS) The Alert List Process 

j^TST^Si/fidF^AVhen the Court issued the first Business Records Order in May 




Database” which was a master target database of foreign and domestic telephone 

identifiers that were of current foreign intelligence interest to counterterrorism personnel. 

4 (TS/ZSlWr) Neither the Agency nor the rest of the US Intelligence Community has changed this view 
regarding the importance of identifying this type of contact between counterterrorism targets and persons 
inside the United States. In fact, the 9/1 1 Commission Report alluded to the failure to share information 
regarding a facility associated with an al Qaeda safehouse in Yemen and contact with one of the 9/1 1 
hijackers (al Mihdbar) in San Diego, California, as an importantreason the Intelligence Community did not 
detect al Qaeda’s planning for the 9/1 1 attack. See, “The 911.1 Commission Report,” at 269-272. - 
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The second source was 



which was and continues to be a database NS A uses as 



a selection management system to manage and task identifiers for SIGINT collection. 



(TS//SI//NF ) The Business Records Order states that “access to the archived data 
shall occur only when NS A has identified a known telephone identifier for which . . . 
there are facts giving rise to a reasonable articulable suspicion that the telephone 
identifier is associated 



Docket BR 08-13, 

Primary Order, 12 December 2008. The term “archived data” is of critical importance to 
understanding the rebuilt alert process NS A implemented after the Court issued the first 
Business Records Order in May 2006. 



(TS//SIVNF )-As normally used by NSA in the context of the Agency’s SIGINT 

activities, the term “archived data” refers to data stored in NSA’s analytical repositories 
and excludes the many processing steps the Agency employs to make the raw collection 
useful to individual intelligence analysts. 5 Based on internal NSA correspondence and 
from discussions with NSA personnel familiar with tire way NSA processes SIGINT 
collection, I have concluded this understanding of the term “archived data” meant that the 
NSA personnel who designed the BR FISA alert list process believed that the 
requirement to satisfy the RAS standard was only triggered when access was sought to 
NSA’s stored [i.e., “archived” in NSA parlance) repository of BR FISA data. 

5 (TS//SI//NF) For example, a small team of “data integrity analysts” ensures that the initial material NSA 
receives as a result of the Business Records Order is properly formatted and does not contain extraneous 
material that the Agency does not need or want before such material is made available to intelligence 
analysts. 
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(TS7VSi^E)Jn fact, when Hie initial draft procedures for implementing the 
Business Records Order were created, it does not appear that either the SIGINT 
Directorate or the Office of General Counsel identified the use of non-RAS approved 
identifiers on the alert list as an issue that required in-depth analysis. NSA personnel, 
including the NSA attorney who reviewed the SIGINT Directorate's implementation 
procedures for the Business Records Order, appear to have viewed the alert system as 
merely pointing to a particular identifier on the alert list that required determination of 
whether the RAS standard had been satisfied before permitting contact chaining and/or 
pattern analysis in the archived BR FISA data. Accordingly, the Office of General 
Counsel approved the procedures but stressed that the RAS standard set out in the 
Business Records Order had to be satisfied before any access to the archived data could 
occur. 6 

(T§77Sf//N£X-As a result, personnel in the SIGINT Directorate who understood 
how the automated alert process worked, based on their own understanding of the term 
“archived data” and the advice of NSA’s Office of General Counsel, did not believe that 
NSA was required to limit the BR FISA alert list to only RAS approved telephone 

identifiers, 



6 (TS//SI//NF) This result is not surprising since, regardless of whether the identifiers on the alert list were 
RAS approved, NSA was lawfully authorized to collect the conversations and metadata associated with the 
non-RAS approved identifiers tasked for NSA SIGINT collection activities under Executive Order 12333 
and included on the alert list. The alert process was intended as a way for analvst^^rioritiz^mr work. 
The alerts did not provide analysts with permissioi^^onduc^ontaci the 

BR FISA metadata. Instead, any contact chaining the BRAIS^iat^riscmquired a 

determination that the seed number for such chaining^^^^^^^^Hhad satisfied the -RAS standard. 
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Rather, they believed the limitation in the Court’s order applied only where data 



had been aggregated over time, and where the authority and ability existed to conduct 



multi-hop analysis across the entire data archive, [See Section VII for a description of • 
the benefits of aggregating data for later analysis.) 



review of this matter has confirmed that, even prior to the 
issuance of the Business Records Order, members of the SIGINT Directorate engaged in 
discussions with representatives of NS A’ s Office of General Counsel to determine how 
the Agency would process the telephony metadata NSA expected to receive pursuant to 
the Court’s Order. Then, on 25 May 2006 immediately after issuance of the first 
Business Records Order, representatives of NSA’s Signals Intelligence Directorate asked 
NSA’s Office of General Counsel to concur on a draft set of procedures the SIGINT 
Directorate had developed to implement the Business Records Order. These draft 
procedures stated: 



The^^^^^^jALERT processing system Mil provide a selective 
notification to the NSA CT AAD Shift Coordinator that a FISA Business 
Record transaction has been received. This notification will contain only the 
foreign telephone number and collection bin category. This notification will 
only occur when the foreign number in the transaction matches the foreign 
telephone number residing in that collection bin. This notification will include 
no domestic numbers and occurs prior to any chaining whatsoever. 



There was no express statement that the alert list contained both RAS and non-RAS 
approved identifiers but it was clear that identifiers in the alert system would be 
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added a footnote to the procedures to read, “As articulated in the FISC 
Order, ‘access to the archived data will occur only when the NSA has identified a known 
telephone number for which, based on the practical considerations of everyday life on 
which reasonable and prudent persons act, there are facts giving rise to a reasonable, 

articulable suspicion that the telephone number is associated with 

Section 5 A.” 

(T S //S l''/NF)- The SIGINT Directorate began using the process described in the 
procedures not long after receiving OGC’s approval, A copy of the procedures approved 
by NSA’s Office of General Counsel and the approval of NSA’s Office of General 
Counsel are attached as Exhibits A and B, respectively. 

-(TS//Ob'/TlFpAs a result, the Agency ultimately designed the alert process to 
result in automated call chaining of the BR FISA data repository if the initial alert was 
based on a RAS approved identifier. If an alert was based on a non-RAS approved 
identifier, no automated chaining would occur in the BR FISA material but automated 
chaining could occur in NSA’s repositories of information that had been acquired under 
circumstances where the RAS requirement did not apply, such as telephony collection 
that w'as not regulated by the FISA. 

(TS//SI//NF) S pecifically, on 26 May 2006, was 
serving as the chief of NS A- Washington’s counterterrorism organization in NSA’s 
Signals Intelligence Directorate, directed that the alert list be rebuilt to ensure that the 
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alert list would only include identifiers assigned to “bins” or “zip codes ” 9 that NS A used 

to label an identifier as being associated with since these 

were the only classes of targets covered by the initial Business Records Order. Pursuant 
to this overall direction, personnel in the counterterrorism organization actually built two 
lists to manage the alert process. The first list - known as the alert list - included all 
identifiers that were of interest to counterterrorism analysts who were charged with 
tracking include both foreign and domestic telephony 

identifiers. This list -was used to compare the incoming telephony metadata NS A Was 
obtaining from the Business Records Order and NS A 5 s other sources of SIGINT 
collection to alert the counterterrorism organization if there was a match between a 
telephone identifier on the list and an identifier in the incoming metadata. This list had 
two partitions. The first partition consisted of RAS approved identifiers which could 
result in automated chaining of the BR FISA data repository. The second partition 
consisted of non-RAS approved identifiers which could not be used to initiate automated 
chaining of the archived BR FISA material. The second list - known as the “station 
table” - served as a historical listing of all telephone identifiers that have undergone a 
RAS determination, to include the results of the determination. This list was used to 
ensure that only RAS approved “seed” identifiers would be used to conduct chaining or 
pattern analysis of NS A’ s data repository for BR FISA material. For the Court’s 







convenience, a pictorial description of the BR FISA alert process as the process operated 
from May 2006 until January 2009 is attached as Exhibit C. 



Incorrect Description of Alert List in Reports to the FISC 

~t^S//SI//NF)jReviews of NSA records and discussions with relevant NSA 
personnel have revealed that 
of General Counsel, prepared the initial draft of the first BR FISA report. 
appears to have included the inaccurate description of the BR FISA alert process due to a 
mistaken belief that the alert process for the Business Records Order 



i managing attorney in NSA’s Office 



completing his initial draft of the BR FISA report, in an email 



prepared on Saturday, 12 August 2006 



•ote: 



Attached is the Draft of the Report to the Court. This is NOT ready to go until 
it is reviewed again... I have done my best to be complete and thorough, but . . . 
make sure everything I have siad (sic) is absolutely true. 
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See Exhibit D. Despite the direction that the draft BR FISA report be thoroughly 
reviewed by other attorneys and NSA operational personnel for accuracy, the inaccurate 
description of the alert list that was contained in the initial draft of the report was not 
corrected before the report was finalized, In addition, the inaccurate description was not 
corrected in subsequent reports to the Court, either, until the inaccurate description was 
identified by representatives from the Department of Justice (“DoJ”) during a briefing 
and roundtable discussion regarding NSA’s handling of BR FISA material on 9 January 
2009. Once DoJ confirmed that the Agency’s actual alert list process in the BR FISA 
was inconsistent with the past descriptions NSA had provided to the Court of the alert list 
process, DoJ filed a notice on 15 January 2009 identifying this problem to the Court. 



— ( TS//SI//NF) As alluded to above, the inaccurate description of the BR FISA alert 
list initially appears to have occurred due to a mistaken belief that the alert list for the 
BR FISA material 

This error was compounded by the fact that, as noted previously, the SIGINT 
Directorate had actually constructed the alert list with two partitions. Moreover, given , 
that the Office of General Counsel prepared the initial draft of the report and had 
previously approved the procedures the SIGINT Directorate drafted for processing the 



BR FISA material, 



is the primary reviewer of the draft report for 



the SIGINT Directorate, thought the Office of General Counsel’ s description of the 
automated alert process for BR FISA material, although omitting a discussion of one of 
the partitions, was legally correct since no contact chaining was 
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